{"vulnerability": "cve-2026-108740", "sightings": [{"uuid": "a5785a28-dbce-4325-a883-b64cf71c8303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108740", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422387792660278", "content": "CVE-2026-108740 GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108740https://hackmd.io/@haind03/goatcounter-user-pref-access-mass-assignment-20261011https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/handlers/settings_user.go#L33-L99https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/user.go#L191-L218https://github.com/arp242/goatcounterhttps://www.vulncheck.com/advisories/goatcounter-through-2.7.0-privilege-escalation-via-user-pref-mass-assignment#arp242 #GoatCounter#CVE_2026_108740#bot", "creation_timestamp": "2026-10-11T12:57:27.219613Z"}, {"uuid": "bcf834e1-5fd4-4c74-8ee1-094f2532e3e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108740", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/jbq624gokhrgz", "content": "CVE-2026-108740 - GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment\nCVE ID : CVE-2026-108740\n \n Published : Oct. 11, 2026, 1:17 p.m. | 13\u00a0minutes ago\n \n Description : GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerab...", "creation_timestamp": "2026-10-11T14:08:10.379624Z"}, {"uuid": "44a9a4dd-ac41-4f95-8b8e-f3da45257f96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108740", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxncziwarb2b", "content": "\ud83d\udfe0 CVE-2026-108740 - High (8.3)\n\nGoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the us...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108740/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-12T01:02:03.678873Z"}]}